fix(net): allow SSO apps egress to keycloak backend (Cilium 1.20 CVE-2025-30162)

App SSO broke cluster-wide after the Cilium 1.16.5->1.20.1 upgrade: the CVE-2025-30162 fix (in
>=1.16.8/1.17.2) makes the shared Gateway's L7 proxy re-evaluate a pod's egress policy against
Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) when it hairpins to keycloak.home.
'toEntities: world' matches the Gateway VIP at L3/L4 but not the resolved keycloak identity at L7, so
OIDC discovery/token 403'd ('Access denied') for every app with a NetworkPolicy (gitea/nextcloud/
semaphore/headlamp/crafty...); Grafana survived only because monitoring has no NetworkPolicy.

Fix: explicit toEndpoints egress allow to the keycloak backend for SSO apps.
- catalog/render.py: emit it for auth.mode in {oidc,forward-auth}; re-rendered 8 app goldens.
- platform/headlamp + platform/crafty: hand-written policies get the same allow.
Split-horizon design unchanged. Verified live: headlamp-ns -> keycloak discovery 403 -> 200.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

catalog/render.py

@@ -527,6 +527,28 @@ def r_internet_egress(s: dict) -> dict:
     switch (a cluster-wide singleton keyed on the egress-class pod label) decide the PATH; this
     policy decides that north-south egress is ALLOWED at all.
     """
+    egress = [{"toEntities": ["world"]}]
+    # SSO apps (oidc/forward-auth) reach Keycloak at keycloak.home, which coredns split-horizon
+    # resolves to the shared Gateway VIP (an L2-announced LoadBalancer IP Cilium classifies as
+    # `world`), so the pod hairpins THROUGH the Gateway. Under Cilium >=1.16.8/1.17.2 (the
+    # CVE-2025-30162 fix, present in 1.20), the Gateway's L7 proxy re-evaluates THIS pod's egress
+    # policy against Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) — `world`
+    # matches the VIP at L3/L4 but NOT the resolved keycloak identity at L7, so OIDC discovery/
+    # token 403s ("Access denied") without an explicit allow to the keycloak backend. Scope it to
+    # the apps that actually talk to Keycloak (auth mode oidc or forward-auth).
+    if s.get("auth", {}).get("mode") in ("oidc", "forward-auth"):
+        egress.append(
+            {
+                "toEndpoints": [
+                    {
+                        "matchLabels": {
+                            "io.kubernetes.pod.namespace": "keycloak",
+                            "app": "keycloak",
+                        }
+                    }
+                ]
+            }
+        )
     return {
         "apiVersion": "cilium.io/v2",
         "kind": "CiliumNetworkPolicy",
@@ -537,7 +559,7 @@ def r_internet_egress(s: dict) -> dict:
         },
         "spec": {
             "endpointSelector": {"matchLabels": {"app.kubernetes.io/name": s["name"]}},
-            "egress": [{"toEntities": ["world"]}],
+            "egress": egress,
         },
     }